X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp.h;h=51386e688441159f2a71e9fd8895709fcc7a611a;hb=490b92738;hp=6c47bb054286c4c39166620e8317611de9c69778;hpb=f539578bac8b64886b57c460c9d74273e6613f8b;p=vpp.git

diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h
index 6c47bb05428..51386e68844 100644
--- a/src/vnet/ipsec/esp.h
+++ b/src/vnet/ipsec/esp.h
@@ -58,6 +58,18 @@ typedef CLIB_PACKED (struct {
 }) ip6_and_esp_header_t;
 /* *INDENT-ON* */
 
+/**
+ * AES counter mode nonce
+ */
+typedef struct
+{
+  u32 salt;
+  u64 iv;
+  u32 ctr; /* counter: 1 in big-endian for ctr, unused for gcm */
+} __clib_packed esp_ctr_nonce_t;
+
+STATIC_ASSERT_SIZEOF (esp_ctr_nonce_t, 16);
+
 /**
  * AES GCM Additional Authentication data
  */
@@ -128,6 +140,46 @@ esp_aad_fill (u8 * data, const esp_header_t * esp, const ipsec_sa_t * sa)
     }
 }
 
+/* Special case to drop or hand off packets for sync/async modes.
+ *
+ * Different than sync mode, async mode only enqueue drop or hand-off packets
+ * to next nodes.
+ */
+always_inline void
+esp_set_next_index (int is_async, u32 * from, u16 * nexts, u32 bi,
+		    u16 * drop_index, u16 drop_next, u16 * next)
+{
+  if (is_async)
+    {
+      from[*drop_index] = bi;
+      nexts[*drop_index] = drop_next;
+      *drop_index += 1;
+    }
+  else
+    next[0] = drop_next;
+}
+
+/* when submitting a frame is failed, drop all buffers in the frame */
+always_inline void
+esp_async_recycle_failed_submit (vnet_crypto_async_frame_t * f,
+				 vlib_buffer_t ** b, u32 * from, u16 * nexts,
+				 u16 * n_dropped, u16 drop_next_index,
+				 vlib_error_t err)
+{
+  u32 n_drop = f->n_elts;
+  u32 *bi = f->buffer_indices;
+  b -= n_drop;
+  while (n_drop--)
+    {
+      b[0]->error = err;
+      esp_set_next_index (1, from, nexts, bi[0], n_dropped, drop_next_index,
+			  NULL);
+      bi++;
+      b++;
+    }
+  vnet_crypto_async_reset_frame (f);
+}
+
 /**
  * The post data structure to for esp_encrypt/decrypt_inline to write to
  * vib_buffer_t opaque unused field, and for post nodes to pick up after
@@ -156,6 +208,7 @@ typedef struct
 } esp_decrypt_packet_data_t;
 
 STATIC_ASSERT_SIZEOF (esp_decrypt_packet_data_t, 3 * sizeof (u64));
+STATIC_ASSERT_OFFSET_OF (esp_decrypt_packet_data_t, seq, sizeof (u64));
 
 /* we are forced to store the decrypt post data into 2 separate places -
    vlib_opaque and opaque2. */
@@ -195,6 +248,7 @@ typedef struct
   u32 esp6_post_next;
   u32 esp4_tun_post_next;
   u32 esp6_tun_post_next;
+  u32 esp_mpls_tun_post_next;
 } esp_async_post_next_t;
 
 extern esp_async_post_next_t esp_encrypt_async_next;